/* Copyright (c) 2001-2004, Roger Dingledine.

 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.

 * Copyright (c) 2007-2021, The Tor Project, Inc. */

/* See LICENSE for licensing information */

/**

 * @file dirclient.c

 * @brief Download directory information

 **/

#define DIRCLIENT_PRIVATE

#include "core/or/or.h"

#include "app/config/config.h"

#include "core/mainloop/connection.h"

#include "core/mainloop/mainloop.h"

#include "core/or/connection_edge.h"

#include "core/or/policies.h"

#include "feature/client/bridges.h"

#include "feature/client/entrynodes.h"

#include "feature/control/control_events.h"

#include "feature/dirauth/authmode.h"

#include "feature/dirclient/dirclient.h"

#include "feature/dirauth/dirvote.h"

#include "feature/dirauth/shared_random.h"

#include "feature/dircache/dirserv.h"

#include "feature/dirclient/dirclient.h"

#include "feature/dirclient/dirclient_modes.h"

#include "feature/dirclient/dlstatus.h"

#include "feature/dircommon/consdiff.h"

#include "feature/dircommon/directory.h"

#include "feature/dircommon/fp_pair.h"

#include "feature/hs/hs_cache.h"

#include "feature/hs/hs_client.h"

#include "feature/hs/hs_control.h"

#include "feature/nodelist/authcert.h"

#include "feature/nodelist/describe.h"

#include "feature/nodelist/dirlist.h"

#include "feature/nodelist/microdesc.h"

#include "feature/nodelist/networkstatus.h"

#include "feature/nodelist/node_select.h"

#include "feature/nodelist/nodelist.h"

#include "feature/nodelist/routerinfo.h"

#include "feature/nodelist/routerlist.h"

#include "feature/nodelist/routerset.h"

#include "feature/relay/relay_find_addr.h"

#include "feature/relay/routermode.h"

#include "feature/relay/selftest.h"

#include "feature/rend/rendcommon.h"

#include "feature/stats/predict_ports.h"

#include "lib/cc/ctassert.h"

#include "lib/compress/compress.h"

#include "lib/crypt_ops/crypto_format.h"

#include "lib/crypt_ops/crypto_util.h"

#include "lib/encoding/confline.h"

#include "lib/err/backtrace.h"

#include "core/or/entry_connection_st.h"

#include "feature/dircache/cached_dir_st.h"

#include "feature/dirclient/dir_server_st.h"

#include "feature/dircommon/dir_connection_st.h"

#include "feature/nodelist/networkstatus_st.h"

#include "feature/nodelist/node_st.h"

#include "feature/nodelist/routerinfo_st.h"

/** Maximum size, in bytes, for any directory object that we've downloaded. */

#define MAX_DIR_DL_SIZE ((1<<24)-1) /* 16 MB - 1 */

/** How far in the future do we allow a directory server to tell us it is

 * before deciding that one of us has the wrong time? */

#define ALLOW_DIRECTORY_TIME_SKEW (30*60)

static int body_is_plausible(const char *body, size_t body_len, int purpose);

static void connection_dir_download_routerdesc_failed(dir_connection_t *conn);

static void connection_dir_bridge_routerdesc_failed(dir_connection_t *conn);

static void connection_dir_download_cert_failed(

                               dir_connection_t *conn, int status_code);

static void connection_dir_retry_bridges(smartlist_t *descs);

static void dir_routerdesc_download_failed(smartlist_t *failed,

                                           int status_code,

                                           int router_purpose,

                                           int was_extrainfo,

                                           int was_descriptor_digests);

static void dir_microdesc_download_failed(smartlist_t *failed,

                                          int status_code,

                                          const char *dir_id);

static void directory_send_command(dir_connection_t *conn,

                                   const int direct,

                                   const directory_request_t *req);

static void connection_dir_close_consensus_fetches(

                   dir_connection_t *except_this_one, const char *resource);

/** Return a string describing a given directory connection purpose. */

STATIC const char *

dir_conn_purpose_to_string(int purpose)

{

  switch (purpose)

    {

    case DIR_PURPOSE_UPLOAD_DIR:

      return "server descriptor upload";

    case DIR_PURPOSE_UPLOAD_VOTE:

      return "consensus vote upload";

    case DIR_PURPOSE_UPLOAD_SIGNATURES:

      return "consensus signature upload";

    case DIR_PURPOSE_FETCH_SERVERDESC:

      return "server descriptor fetch";

    case DIR_PURPOSE_FETCH_EXTRAINFO:

      return "extra-info fetch";

    case DIR_PURPOSE_FETCH_CONSENSUS:

      return "consensus network-status fetch";

    case DIR_PURPOSE_FETCH_CERTIFICATE:

      return "authority cert fetch";

    case DIR_PURPOSE_FETCH_STATUS_VOTE:

      return "status vote fetch";

    case DIR_PURPOSE_FETCH_DETACHED_SIGNATURES:

      return "consensus signature fetch";

    case DIR_PURPOSE_FETCH_HSDESC:

      return "hidden-service descriptor fetch";

    case DIR_PURPOSE_UPLOAD_HSDESC:

      return "hidden-service descriptor upload";

    case DIR_PURPOSE_FETCH_MICRODESC:

      return "microdescriptor fetch";

    }

  log_warn(LD_BUG, "Called with unknown purpose %d", purpose);

  return "(unknown)";

}

/** Return the requisite directory information types. */

STATIC dirinfo_type_t

dir_fetch_type(int dir_purpose, int router_purpose, const char *resource)

{

  dirinfo_type_t type;

  switch (dir_purpose) {

    case DIR_PURPOSE_FETCH_EXTRAINFO:

      type = EXTRAINFO_DIRINFO;

      if (router_purpose == ROUTER_PURPOSE_BRIDGE)

        type |= BRIDGE_DIRINFO;

      else

        type |= V3_DIRINFO;

      break;

    case DIR_PURPOSE_FETCH_SERVERDESC:

      if (router_purpose == ROUTER_PURPOSE_BRIDGE)

        type = BRIDGE_DIRINFO;

      else

        type = V3_DIRINFO;

      break;

    case DIR_PURPOSE_FETCH_STATUS_VOTE:

    case DIR_PURPOSE_FETCH_DETACHED_SIGNATURES:

    case DIR_PURPOSE_FETCH_CERTIFICATE:

      type = V3_DIRINFO;

      break;

    case DIR_PURPOSE_FETCH_CONSENSUS:

      type = V3_DIRINFO;

      if (resource && !strcmp(resource, "microdesc"))

        type |= MICRODESC_DIRINFO;

      break;

    case DIR_PURPOSE_FETCH_MICRODESC:

      type = MICRODESC_DIRINFO;

      break;

    default:

      log_warn(LD_BUG, "Unexpected purpose %d", (int)dir_purpose);

      type = NO_DIRINFO;

      break;

  }

  return type;

}

/** Return true iff <b>identity_digest</b> is the digest of a router which

 * says that it caches extrainfos.  (If <b>is_authority</b> we always

 * believe that to be true.) */

int

router_supports_extrainfo(const char *identity_digest, int is_authority)

{

  const node_t *node = node_get_by_id(identity_digest);

  if (node && node->ri) {

    if (node->ri->caches_extra_info)

      return 1;

  }

  if (is_authority) {

    return 1;

  }

  return 0;

}

/** Return true iff any trusted directory authority has accepted our

 * server descriptor.

 *

 * We consider any authority sufficient because waiting for all of

 * them means it never happens while any authority is down; we don't

 * go for something more complex in the middle (like \>1/3 or \>1/2 or

 * \>=1/2) because that doesn't seem necessary yet.

 */

int

directories_have_accepted_server_descriptor(void)

{

  const smartlist_t *servers = router_get_trusted_dir_servers();

  const or_options_t *options = get_options();

  SMARTLIST_FOREACH(servers, dir_server_t *, d, {

    if ((d->type & options->PublishServerDescriptor_) &&

        d->has_accepted_serverdesc) {

      return 1;

    }

  });

  return 0;

}

/** Start a connection to every suitable directory authority, using

 * connection purpose <b>dir_purpose</b> and uploading <b>payload</b>

 * (of length <b>payload_len</b>). The dir_purpose should be one of

 * 'DIR_PURPOSE_UPLOAD_{DIR|VOTE|SIGNATURES}'.

 *

 * <b>router_purpose</b> describes the type of descriptor we're

 * publishing, if we're publishing a descriptor -- e.g. general or bridge.

 *

 * <b>type</b> specifies what sort of dir authorities (V3,

 * BRIDGE, etc) we should upload to.

 *

 * If <b>extrainfo_len</b> is nonzero, the first <b>payload_len</b> bytes of

 * <b>payload</b> hold a router descriptor, and the next <b>extrainfo_len</b>

 * bytes of <b>payload</b> hold an extra-info document.  Upload the descriptor

 * to all authorities, and the extra-info document to all authorities that

 * support it.

 */

void

directory_post_to_dirservers(uint8_t dir_purpose, uint8_t router_purpose,

                             dirinfo_type_t type,

                             const char *payload,

                             size_t payload_len, size_t extrainfo_len)

{

  const or_options_t *options = get_options();

  dir_indirection_t indirection;

  const smartlist_t *dirservers = router_get_trusted_dir_servers();

  int found = 0;

  const int exclude_self = (dir_purpose == DIR_PURPOSE_UPLOAD_VOTE ||

                            dir_purpose == DIR_PURPOSE_UPLOAD_SIGNATURES);

  tor_assert(dirservers);

  /* This tries dirservers which we believe to be down, but ultimately, that's

   * harmless, and we may as well err on the side of getting things uploaded.

   */

  SMARTLIST_FOREACH_BEGIN(dirservers, dir_server_t *, ds) {

      const routerstatus_t *rs = router_get_consensus_status_by_id(ds->digest);

      if (!rs) {

        /* prefer to use the address in the consensus, but fall back to

         * the hard-coded trusted_dir_server address if we don't have a

         * consensus or this digest isn't in our consensus. */

        rs = &ds->fake_status;

      }

      size_t upload_len = payload_len;

      if ((type & ds->type) == 0)

        continue;

      if (exclude_self && router_digest_is_me(ds->digest)) {

        /* we don't upload to ourselves, but there's now at least

         * one authority of this type that has what we wanted to upload. */

        found = 1;

        continue;

      }

      if (options->StrictNodes &&

          routerset_contains_routerstatus(options->ExcludeNodes, rs, -1)) {

        log_warn(LD_DIR, "Wanted to contact authority '%s' for %s, but "

                 "it's in our ExcludedNodes list and StrictNodes is set. "

                 "Skipping.",

                 ds->nickname,

                 dir_conn_purpose_to_string(dir_purpose));

        continue;

      }

      found = 1; /* at least one authority of this type was listed */

      if (dir_purpose == DIR_PURPOSE_UPLOAD_DIR)

        ds->has_accepted_serverdesc = 0;

      if (extrainfo_len && router_supports_extrainfo(ds->digest, 1)) {

        upload_len += extrainfo_len;

        log_info(LD_DIR, "Uploading an extrainfo too (length %d)",

                 (int) extrainfo_len);

      }

      if (purpose_needs_anonymity(dir_purpose, router_purpose, NULL)) {

        indirection = DIRIND_ANONYMOUS;

      } else if (!reachable_addr_allows_rs(rs, FIREWALL_DIR_CONNECTION, 0)) {

        if (reachable_addr_allows_rs(rs, FIREWALL_OR_CONNECTION, 0))

          indirection = DIRIND_ONEHOP;

        else

          indirection = DIRIND_ANONYMOUS;

      } else {

        indirection = DIRIND_DIRECT_CONN;

      }

      directory_request_t *req = directory_request_new(dir_purpose);

      directory_request_set_routerstatus(req, rs);

      directory_request_set_router_purpose(req, router_purpose);

      directory_request_set_indirection(req, indirection);

      directory_request_set_payload(req, payload, upload_len);

      directory_initiate_request(req);

      directory_request_free(req);

  } SMARTLIST_FOREACH_END(ds);

  if (!found) {

    char *s = authdir_type_to_string(type);

    log_warn(LD_DIR, "Publishing server descriptor to directory authorities "

             "of type '%s', but no authorities of that type listed!", s);

    tor_free(s);

  }

}

/** Return true iff, according to the values in <b>options</b>, we should be

 * using directory guards for direct downloads of directory information. */

STATIC int

should_use_directory_guards(const or_options_t *options)

{

  /* Public (non-bridge) servers never use directory guards. */

  if (public_server_mode(options))

    return 0;

  /* If guards are disabled, we can't use directory guards.

   */

  if (!options->UseEntryGuards)

    return 0;

  /* If we're configured to fetch directory info aggressively or of a

   * nonstandard type, don't use directory guards. */

  if (options->DownloadExtraInfo || options->FetchDirInfoEarly ||

      options->FetchDirInfoExtraEarly || options->FetchUselessDescriptors)

    return 0;

  return 1;

}

/** Pick an unconstrained directory server from among our guards, the latest

 * networkstatus, or the fallback dirservers, for use in downloading

 * information of type <b>type</b>, and return its routerstatus. */

static const routerstatus_t *

directory_pick_generic_dirserver(dirinfo_type_t type, int pds_flags,

                                 uint8_t dir_purpose,

                                 circuit_guard_state_t **guard_state_out)

{

  const routerstatus_t *rs = NULL;

  const or_options_t *options = get_options();

  if (options->UseBridges)

    log_warn(LD_BUG, "Called when we have UseBridges set.");

  if (should_use_directory_guards(options)) {

    const node_t *node = guards_choose_dirguard(dir_purpose, guard_state_out);

    if (node)

      rs = node->rs;

  } else {

    /* anybody with a non-zero dirport will do */

    rs = router_pick_directory_server(type, pds_flags);

  }

  if (!rs) {

    log_info(LD_DIR, "No router found for %s; falling back to "

             "dirserver list.", dir_conn_purpose_to_string(dir_purpose));

    rs = router_pick_fallback_dirserver(type, pds_flags);

  }

  return rs;

}

/**

 * Set the extra fields in <b>req</b> that are used when requesting a

 * consensus of type <b>resource</b>.

 *

 * Right now, these fields are if-modified-since and x-or-diff-from-consensus.

 */

static void

dir_consensus_request_set_additional_headers(directory_request_t *req,

                                             const char *resource)

{

  time_t if_modified_since = 0;

  uint8_t or_diff_from[DIGEST256_LEN];

  int or_diff_from_is_set = 0;

  /* DEFAULT_IF_MODIFIED_SINCE_DELAY is 1/20 of the default consensus

   * period of 1 hour.

   */

  const int DEFAULT_IF_MODIFIED_SINCE_DELAY = 180;

  const int32_t DEFAULT_TRY_DIFF_FOR_CONSENSUS_NEWER = 72;

  const int32_t MIN_TRY_DIFF_FOR_CONSENSUS_NEWER = 0;

  const int32_t MAX_TRY_DIFF_FOR_CONSENSUS_NEWER = 8192;

  const char TRY_DIFF_FOR_CONSENSUS_NEWER_NAME[] =

    "try-diff-for-consensus-newer-than";

  int flav = FLAV_NS;

  if (resource)

    flav = networkstatus_parse_flavor_name(resource);

  int32_t max_age_for_diff = 3600 *

    networkstatus_get_param(NULL,

                            TRY_DIFF_FOR_CONSENSUS_NEWER_NAME,

                            DEFAULT_TRY_DIFF_FOR_CONSENSUS_NEWER,

                            MIN_TRY_DIFF_FOR_CONSENSUS_NEWER,

                            MAX_TRY_DIFF_FOR_CONSENSUS_NEWER);

  if (flav != -1) {

    /* IF we have a parsed consensus of this type, we can do an

     * if-modified-time based on it. */

    networkstatus_t *v;

    v = networkstatus_get_latest_consensus_by_flavor(flav);

    if (v) {

      /* In networks with particularly short V3AuthVotingIntervals,

       * ask for the consensus if it's been modified since half the

       * V3AuthVotingInterval of the most recent consensus. */

      time_t ims_delay = DEFAULT_IF_MODIFIED_SINCE_DELAY;

      if (v->fresh_until > v->valid_after

          && ims_delay > (v->fresh_until - v->valid_after)/2) {

        ims_delay = (v->fresh_until - v->valid_after)/2;

      }

      if_modified_since = v->valid_after + ims_delay;

      if (v->valid_after >= approx_time() - max_age_for_diff) {

        memcpy(or_diff_from, v->digest_sha3_as_signed, DIGEST256_LEN);

        or_diff_from_is_set = 1;

      }

    }

  } else {

    /* Otherwise it might be a consensus we don't parse, but which we

     * do cache.  Look at the cached copy, perhaps. */

    cached_dir_t *cd = dirserv_get_consensus(resource);

    /* We have no method of determining the voting interval from an

     * unparsed consensus, so we use the default. */

    if (cd) {

      if_modified_since = cd->published + DEFAULT_IF_MODIFIED_SINCE_DELAY;

      if (cd->published >= approx_time() - max_age_for_diff) {

        memcpy(or_diff_from, cd->digest_sha3_as_signed, DIGEST256_LEN);

        or_diff_from_is_set = 1;

      }

    }

  }

  if (if_modified_since > 0)

    directory_request_set_if_modified_since(req, if_modified_since);

  if (or_diff_from_is_set) {

    char hex[HEX_DIGEST256_LEN + 1];

    base16_encode(hex, sizeof(hex),

                  (const char*)or_diff_from, sizeof(or_diff_from));

    directory_request_add_header(req, X_OR_DIFF_FROM_CONSENSUS_HEADER, hex);

  }

}

/** Start a connection to a random running directory server, using

 * connection purpose <b>dir_purpose</b>, intending to fetch descriptors

 * of purpose <b>router_purpose</b>, and requesting <b>resource</b>.

 * Use <b>pds_flags</b> as arguments to router_pick_directory_server()

 * or router_pick_trusteddirserver().

 */

MOCK_IMPL(void,

directory_get_from_dirserver,(

                            uint8_t dir_purpose,

                            uint8_t router_purpose,

                            const char *resource,

                            int pds_flags,

                            download_want_authority_t want_authority))

{

  const routerstatus_t *rs = NULL;

  const or_options_t *options = get_options();

  int prefer_authority = (dirclient_fetches_from_authorities(options)

                          || want_authority == DL_WANT_AUTHORITY);

  int require_authority = 0;

  int get_via_tor = purpose_needs_anonymity(dir_purpose, router_purpose,

                                            resource);

  dirinfo_type_t type = dir_fetch_type(dir_purpose, router_purpose, resource);

  if (type == NO_DIRINFO)

    return;

  if (!options->FetchServerDescriptors)

    return;

  circuit_guard_state_t *guard_state = NULL;

  if (!get_via_tor) {

    if (options->UseBridges && !(type & BRIDGE_DIRINFO)) {

      /* We want to ask a running bridge for which we have a descriptor.

       *

       * When we ask choose_random_entry() for a bridge, we specify what

       * sort of dir fetch we'll be doing, so it won't return a bridge

       * that can't answer our question.

       */

      const node_t *node = guards_choose_dirguard(dir_purpose, &guard_state);

      if (node && node->ri) {

        /* every bridge has a routerinfo. */

        routerinfo_t *ri = node->ri;

        /* clients always make OR connections to bridges */

        tor_addr_port_t or_ap;

        directory_request_t *req = directory_request_new(dir_purpose);

        /* we are willing to use a non-preferred address if we need to */

        reachable_addr_choose_from_node(node, FIREWALL_OR_CONNECTION, 0,

                                             &or_ap);

        directory_request_set_or_addr_port(req, &or_ap);

        directory_request_set_directory_id_digest(req,

                                            ri->cache_info.identity_digest);

        directory_request_set_router_purpose(req, router_purpose);

        directory_request_set_resource(req, resource);

        if (dir_purpose == DIR_PURPOSE_FETCH_CONSENSUS)

          dir_consensus_request_set_additional_headers(req, resource);

        directory_request_set_guard_state(req, guard_state);

        directory_initiate_request(req);

        directory_request_free(req);

      } else {

        if (guard_state) {

          entry_guard_cancel(&guard_state);

        }

        log_notice(LD_DIR, "Ignoring directory request, since no bridge "

                           "nodes are available yet.");

      }

      return;

    } else {

      if (prefer_authority || (type & BRIDGE_DIRINFO)) {

        /* only ask authdirservers, and don't ask myself */

        rs = router_pick_trusteddirserver(type, pds_flags);

        if (rs == NULL && (pds_flags & (PDS_NO_EXISTING_SERVERDESC_FETCH|

                                        PDS_NO_EXISTING_MICRODESC_FETCH))) {

          /* We don't want to fetch from any authorities that we're currently

           * fetching server descriptors from, and we got no match.  Did we

           * get no match because all the authorities have connections

           * fetching server descriptors (in which case we should just

           * return,) or because all the authorities are down or on fire or

           * unreachable or something (in which case we should go on with

           * our fallback code)? */

          pds_flags &= ~(PDS_NO_EXISTING_SERVERDESC_FETCH|

                         PDS_NO_EXISTING_MICRODESC_FETCH);

          rs = router_pick_trusteddirserver(type, pds_flags);

          if (rs) {

            log_debug(LD_DIR, "Deferring serverdesc fetch: all authorities "

                      "are in use.");

            return;

          }

        }

        if (rs == NULL && require_authority) {

          log_info(LD_DIR, "No authorities were available for %s: will try "

                   "later.", dir_conn_purpose_to_string(dir_purpose));

          return;

        }

      }

      if (!rs && !(type & BRIDGE_DIRINFO)) {

        rs = directory_pick_generic_dirserver(type, pds_flags,

                                              dir_purpose,

                                              &guard_state);

        if (!rs)

          get_via_tor = 1; /* last resort: try routing it via Tor */

      }

    }

  }

  if (get_via_tor) {

    /* Never use fascistfirewall; we're going via Tor. */

    pds_flags |= PDS_IGNORE_FASCISTFIREWALL;

    rs = router_pick_directory_server(type, pds_flags);

  }

  /* If we have any hope of building an indirect conn, we know some router

   * descriptors.  If (rs==NULL), we can't build circuits anyway, so

   * there's no point in falling back to the authorities in this case. */

  if (rs) {

    const dir_indirection_t indirection =

      get_via_tor ? DIRIND_ANONYMOUS : DIRIND_ONEHOP;

    directory_request_t *req = directory_request_new(dir_purpose);

    directory_request_set_routerstatus(req, rs);

    directory_request_set_router_purpose(req, router_purpose);

    directory_request_set_indirection(req, indirection);

    directory_request_set_resource(req, resource);

    if (dir_purpose == DIR_PURPOSE_FETCH_CONSENSUS)

      dir_consensus_request_set_additional_headers(req, resource);

    if (guard_state)

      directory_request_set_guard_state(req, guard_state);

    directory_initiate_request(req);

    directory_request_free(req);

  } else {

    log_notice(LD_DIR,

               "While fetching directory info, "

               "no running dirservers known. Will try again later. "

               "(purpose %d)", dir_purpose);

    if (!purpose_needs_anonymity(dir_purpose, router_purpose, resource)) {

      /* remember we tried them all and failed. */

      directory_all_unreachable(time(NULL));

    }

  }

}

/** As directory_get_from_dirserver, but initiates a request to <i>every</i>

 * directory authority other than ourself.  Only for use by authorities when

 * searching for missing information while voting. */

void

directory_get_from_all_authorities(uint8_t dir_purpose,

                                   uint8_t router_purpose,

                                   const char *resource)

{

  tor_assert(dir_purpose == DIR_PURPOSE_FETCH_STATUS_VOTE ||

             dir_purpose == DIR_PURPOSE_FETCH_DETACHED_SIGNATURES);

  SMARTLIST_FOREACH_BEGIN(router_get_trusted_dir_servers(),

                          dir_server_t *, ds) {

      if (router_digest_is_me(ds->digest))

        continue;

      if (!(ds->type & V3_DIRINFO))

        continue;

      const routerstatus_t *rs = router_get_consensus_status_by_id(ds->digest);

      if (!rs) {

        /* prefer to use the address in the consensus, but fall back to

         * the hard-coded trusted_dir_server address if we don't have a

         * consensus or this digest isn't in our consensus. */

        rs = &ds->fake_status;

      }

      directory_request_t *req = directory_request_new(dir_purpose);

      directory_request_set_routerstatus(req, rs);

      directory_request_set_router_purpose(req, router_purpose);

      directory_request_set_resource(req, resource);

      directory_initiate_request(req);

      directory_request_free(req);

  } SMARTLIST_FOREACH_END(ds);

}

/** Return true iff <b>ind</b> requires a multihop circuit. */

static int

dirind_is_anon(dir_indirection_t ind)

{

  return ind == DIRIND_ANON_DIRPORT || ind == DIRIND_ANONYMOUS;

}

/* Choose reachable OR and Dir addresses and ports from status, copying them

 * into use_or_ap and use_dir_ap. If indirection is anonymous, then we're

 * connecting via another relay, so choose the primary IPv4 address and ports.

 *

 * status should have at least one reachable address, if we can't choose a

 * reachable address, warn and return -1. Otherwise, return 0.

 */

static int

directory_choose_address_routerstatus(const routerstatus_t *status,

                                      dir_indirection_t indirection,

                                      tor_addr_port_t *use_or_ap,

                                      tor_addr_port_t *use_dir_ap)

{

  tor_assert(status != NULL);

  tor_assert(use_or_ap != NULL);

  tor_assert(use_dir_ap != NULL);

  const or_options_t *options = get_options();

  int have_or = 0, have_dir = 0;

  /* We expect status to have at least one reachable address if we're

   * connecting to it directly.

   *

   * Therefore, we can simply use the other address if the one we want isn't

   * allowed by the firewall.

   *

   * (When Tor uploads and downloads a hidden service descriptor, it uses

   * DIRIND_ANONYMOUS. Even Single Onion Servers (NYI) use DIRIND_ANONYMOUS,

   * to avoid HSDirs denying service by rejecting descriptors.)

   */

  /* Initialise the OR / Dir addresses */

  tor_addr_make_null(&use_or_ap->addr, AF_UNSPEC);

  use_or_ap->port = 0;

  tor_addr_make_null(&use_dir_ap->addr, AF_UNSPEC);

  use_dir_ap->port = 0;

  /* ORPort connections */

  if (indirection == DIRIND_ANONYMOUS) {

    if (!tor_addr_is_null(&status->ipv4_addr)) {

      /* Since we're going to build a 3-hop circuit and ask the 2nd relay

       * to extend to this address, always use the primary (IPv4) OR address */

      tor_addr_copy(&use_or_ap->addr, &status->ipv4_addr);

      use_or_ap->port = status->ipv4_orport;

      have_or = 1;

    }

  } else if (indirection == DIRIND_ONEHOP) {

    /* We use an IPv6 address if we have one and we prefer it.

     * Use the preferred address and port if they are reachable, otherwise,

     * use the alternate address and port (if any).

     */

    reachable_addr_choose_from_rs(status, FIREWALL_OR_CONNECTION, 0,

                                       use_or_ap);

    have_or = tor_addr_port_is_valid_ap(use_or_ap, 0);

  }

  /* DirPort connections

   * DIRIND_ONEHOP uses ORPort, but may fall back to the DirPort on relays */

  if (indirection == DIRIND_DIRECT_CONN ||

      indirection == DIRIND_ANON_DIRPORT ||

      (indirection == DIRIND_ONEHOP

       && !dirclient_must_use_begindir(options))) {

    reachable_addr_choose_from_rs(status, FIREWALL_DIR_CONNECTION, 0,

                                       use_dir_ap);

    have_dir = tor_addr_port_is_valid_ap(use_dir_ap, 0);

  }

  /* We rejected all addresses in the relay's status. This means we can't

   * connect to it. */

  if (!have_or && !have_dir) {

    char *ipv6_str = tor_addr_to_str_dup(&status->ipv6_addr);

    log_info(LD_BUG, "Rejected all OR and Dir addresses from %s when "

             "launching an outgoing directory connection to: IPv4 %s OR %d "

             "Dir %d IPv6 %s OR %d Dir %d", routerstatus_describe(status),

             fmt_addr(&status->ipv4_addr), status->ipv4_orport,

             status->ipv4_dirport, ipv6_str, status->ipv6_orport,

             status->ipv4_dirport);

    tor_free(ipv6_str);

    log_backtrace_once(LOG_INFO, LD_BUG, "Addresses came from");

    return -1;

  }

  return 0;

}

/** Called when we are unable to complete the client's request to a directory

 * server due to a network error: Mark the router as down and try again if

 * possible.

 */

void

connection_dir_client_request_failed(dir_connection_t *conn)

{

  if (conn->guard_state) {

    /* We haven't seen a success on this guard state, so consider it to have

     * failed. */

    entry_guard_failed(&conn->guard_state);

  }

  if (!entry_list_is_constrained(get_options()))

    /* We must not set a directory to non-running for HS purposes else we end

     * up flagging nodes from the hashring has unusable. It doesn't have direct

     * effect on the HS subsystem because the nodes are selected regardless of

     * their status but still, we shouldn't flag them as non running.

     *

     * One example where this can go bad is if a tor instance gets added a lot

     * of ephemeral services and with a network with problem then many nodes in

     * the consenus ends up unusable.

     *

     * Furthermore, a service does close any pending directory connections

     * before uploading a descriptor and thus we can end up here in a natural

     * way since closing a pending directory connection leads to this code

     * path. */

    if (!DIR_PURPOSE_IS_HS(TO_CONN(conn)->purpose)) {

      router_set_status(conn->identity_digest, 0);

    }

  if (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||

             conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO) {

    log_info(LD_DIR, "Giving up on serverdesc/extrainfo fetch from "

             "directory server at %s; retrying",

             connection_describe_peer(TO_CONN(conn)));

    if (conn->router_purpose == ROUTER_PURPOSE_BRIDGE)

      connection_dir_bridge_routerdesc_failed(conn);

    connection_dir_download_routerdesc_failed(conn);

  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_CONSENSUS) {

    if (conn->requested_resource)

      networkstatus_consensus_download_failed(0, conn->requested_resource);

  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_CERTIFICATE) {

    log_info(LD_DIR, "Giving up on certificate fetch from directory server "

             "at %s; retrying",

             connection_describe_peer(TO_CONN(conn)));

    connection_dir_download_cert_failed(conn, 0);

  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_DETACHED_SIGNATURES) {

    log_info(LD_DIR, "Giving up downloading detached signatures from %s",

             connection_describe_peer(TO_CONN(conn)));

  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_STATUS_VOTE) {

    log_info(LD_DIR, "Giving up downloading votes from %s",

             connection_describe_peer(TO_CONN(conn)));

  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC) {

    log_info(LD_DIR, "Giving up on downloading microdescriptors from "

             "directory server at %s; will retry",

             connection_describe_peer(TO_CONN(conn)));

    connection_dir_download_routerdesc_failed(conn);

  } else if (conn->base_.purpose == DIR_PURPOSE_UPLOAD_VOTE ||

             conn->base_.purpose == DIR_PURPOSE_UPLOAD_SIGNATURES) {

    log_warn(LD_DIR, "Failed to post %s to %s.",

             dir_conn_purpose_to_string(conn->base_.purpose),

             connection_describe_peer(TO_CONN(conn)));

  }

}

/** Helper: Attempt to fetch directly the descriptors of each bridge

 * listed in <b>failed</b>.

 */

static void

connection_dir_retry_bridges(smartlist_t *descs)

{

  char digest[DIGEST_LEN];

  SMARTLIST_FOREACH(descs, const char *, cp,

  {

    if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {

      log_warn(LD_BUG, "Malformed fingerprint in list: %s",

              escaped(cp));

      continue;

    }

    retry_bridge_descriptor_fetch_directly(digest);

  });

}

/** Called when an attempt to download one or more router descriptors

 * or extra-info documents on connection <b>conn</b> failed.

 */

static void

connection_dir_download_routerdesc_failed(dir_connection_t *conn)

{

  /* No need to increment the failure count for routerdescs, since

   * it's not their fault. */

  /* No need to relaunch descriptor downloads here: we already do it

   * every 10 or 60 seconds (FOO_DESCRIPTOR_RETRY_INTERVAL) in main.c. */

  tor_assert(conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||

             conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||

             conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);

  (void) conn;

}

/** Called when an attempt to download a bridge's routerdesc from

 * one of the authorities failed due to a network error. If

 * possible attempt to download descriptors from the bridge directly.

 */

static void

connection_dir_bridge_routerdesc_failed(dir_connection_t *conn)

{

  smartlist_t *which = NULL;

  /* Requests for bridge descriptors are in the form 'fp/', so ignore

     anything else. */

  if (!conn->requested_resource || strcmpstart(conn->requested_resource,"fp/"))

    return;

  which = smartlist_new();

  dir_split_resource_into_fingerprints(conn->requested_resource

                                        + strlen("fp/"),

                                       which, NULL, 0);

  tor_assert(conn->base_.purpose != DIR_PURPOSE_FETCH_EXTRAINFO);

  if (smartlist_len(which)) {

    connection_dir_retry_bridges(which);

    SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));

  }

  smartlist_free(which);

}

/** Called when an attempt to fetch a certificate fails. */

static void

connection_dir_download_cert_failed(dir_connection_t *conn, int status)

{

  const char *fp_pfx = "fp/";

  const char *fpsk_pfx = "fp-sk/";

  smartlist_t *failed;

  tor_assert(conn->base_.purpose == DIR_PURPOSE_FETCH_CERTIFICATE);

  if (!conn->requested_resource)

    return;

  failed = smartlist_new();

  /*

   * We have two cases download by fingerprint (resource starts

   * with "fp/") or download by fingerprint/signing key pair

   * (resource starts with "fp-sk/").

   */

  if (!strcmpstart(conn->requested_resource, fp_pfx)) {

    /* Download by fingerprint case */

    dir_split_resource_into_fingerprints(conn->requested_resource +

                                         strlen(fp_pfx),

                                         failed, NULL, DSR_HEX);

    SMARTLIST_FOREACH_BEGIN(failed, char *, cp) {

      /* Null signing key digest indicates download by fp only */

      authority_cert_dl_failed(cp, NULL, status);

      tor_free(cp);

    } SMARTLIST_FOREACH_END(cp);

  } else if (!strcmpstart(conn->requested_resource, fpsk_pfx)) {

    /* Download by (fp,sk) pairs */

    dir_split_resource_into_fingerprint_pairs(conn->requested_resource +

                                              strlen(fpsk_pfx), failed);

    SMARTLIST_FOREACH_BEGIN(failed, fp_pair_t *, cp) {

      authority_cert_dl_failed(cp->first, cp->second, status);

      tor_free(cp);

    } SMARTLIST_FOREACH_END(cp);

  } else {

    log_warn(LD_DIR,

             "Don't know what to do with failure for cert fetch %s",

             conn->requested_resource);

  }

  smartlist_free(failed);

  update_certificate_downloads(time(NULL));

}

/** Evaluate the situation and decide if we should use an encrypted

 * "begindir-style" connection for this directory request.

 * 0) If there is no DirPort, yes.

 * 1) If or_port is 0, or it's a direct conn and or_port is firewalled

 *    or we're a dir mirror, no.

 * 2) If we prefer to avoid begindir conns, and we're not fetching or

 *    publishing a bridge relay descriptor, no.

 * 3) Else yes.

 * If returning 0, return in *reason why we can't use begindir.

 * reason must not be NULL.

 */

static int

directory_command_should_use_begindir(const or_options_t *options,

                                      const directory_request_t *req,

                                      const char **reason)

{

  const tor_addr_t *or_addr = &req->or_addr_port.addr;

  //const tor_addr_t *dir_addr = &req->dir_addr_port.addr;

  const int or_port = req->or_addr_port.port;

  const int dir_port = req->dir_addr_port.port;

  const dir_indirection_t indirection = req->indirection;

  tor_assert(reason);